Security Policy
GRX10 Solutions Private Limited
We take the security of the GRX10 suite (Voice AI, Micro CRM, Nudge) seriously. This document explains how to report vulnerabilities and summarises our security practices. Publish a customer-facing version at https://grx10.com/security and commit this file to the root of each product repository as SECURITY.md.
Reporting a vulnerability
Email security@grx10.com with steps to reproduce, affected component, and impact. Please do not publicly disclose until we have had a reasonable opportunity to remediate.
- We aim to acknowledge within 2 business days.
- We will keep you updated on remediation progress.
- We do not currently run a paid bug-bounty, but we credit reporters who follow responsible disclosure.
Do not run tests that degrade service, access other customers' data, or exfiltrate personal data. Contact us first if in doubt.
Our practices (summary)
- Access control: role-based access (owner/admin/member/viewer) with least-privilege; per-module permission enforcement.
- Audit: tamper-evident audit logging of account and administrative actions.
- Change management: protected branches, mandatory code-owner review, signed commits, linear history and no self-merge.
- Vulnerability management: automated dependency scanning (Dependabot) and secret scanning (gitleaks) in CI.
- Data in transit: TLS everywhere; webhook payloads verified with HMAC signatures.
- Data at rest / retention: call recordings are kept 90 days by default; longer retention is available on Growth and Enterprise plans (see Pricing); deletion on request.
- Payments: card data handled by a PCI-compliant processor; GRX10 does not store card numbers.
In progress
We are actively working toward SOC 2 and formal privacy-law attestations (DPDP, GDPR). Contact security@grx10.com for our current status or to request our security package.